Lion Cipher Lab
Build a host firewall with nftables
- Cyber / Security Engineer
- Beginner
- ~40 min
- Free · no account required
Why it matters
A firewall is the most basic control that decides which network traffic a machine will even talk to, and on Linux the modern tool for the job is nftables, the in-kernel framework that replaces the older iptables. The idea that pays off everywhere is default-deny: instead of trying to block every bad thing one rule at a time, you drop everything by default and then allow only the handful of things you actually need. That flips the burden of proof — an exposed service you forgot about is closed until you explicitly open it, which is exactly the mistake attackers hunt for. Learning to write a…
What you'll learn
- host firewalling
- default-deny design
- nftables tables/chains/rules
- stateful filtering (established/related)
- not locking yourself out
- making a ruleset persistent
Steps in this lab
- What a host firewall is, and why default-deny
- Install and enable nftables
- Safety first: don't lock yourself out
- Write the base ruleset
- Look at the live ruleset
- Test that allowed passes and blocked drops
- Make it persistent
- What you built, and the habit underneath it